Loading story…
A public disclosure reported that wolfSSL versions 5.7.2 through 5.9.0-stable contain a flaw in the ML-DSA-44 signing path that frees a heap buffer holding private signing material without clearing it first. In native ML-DSA builds enabled with --enable-mldsa or --enable-dilithium, a same-process attacker can recover secret key material from reused heap memory and forge signatures on arbitrary messages. Researcher Abhinav Agarwal demonstrated end-to-end signature forgery on Linux and macOS, with forged signatures accepted by wc_dilithium_verify_msg() in compiled libwolfssl binaries.
wolfSSL confirmed the issue and addressed it through fixes referenced in pull requests #10100 and #10113, with the remediation shipping in wolfSSL 5.9.1-stable. The vendor did not assign a CVE and reportedly classified the finding as a bug rather than a vulnerability, even as its broader release advisory warned of multiple cryptographic verification weaknesses affecting certificate validation and signature handling. The disclosure also noted that similar missing-memory-clearing problems had previously been corrected in wolfSSL code paths for Dilithium key generation, Ed25519 signing, and Ed448 signing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
wolfSSL published release 5.9.1-stable, which includes fixes for multiple security issues and is the release recommended for users to update to. The release follows the ML-DSA disclosure and broader advisory covering certificate verification, parsing, TLS/DTLS, and cryptographic verification flaws.
A public disclosure on oss-security/openwall described the same-process heap reuse issue in wolfSSL and noted that forged signatures were accepted by wc_dilithium_verify_msg() in compiled libwolfssl binaries. wolfSSL confirmed the finding, said fixes were made in pull requests #10100 and #10113, and no CVE was assigned because the vendor classified it as a bug rather than a vulnerability.
Abhinav Agarwal found that wolfSSL's ML-DSA-44 signing path frees a heap buffer containing private signing material without zeroing it, allowing a same-process attacker to recover key material from reused memory and forge signatures. The issue affects native ML-DSA builds in wolfSSL versions 5.7.2 through 5.9.0-stable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceseclists.org
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly disclosed vulnerability, **CVE-2026-5194**, affects wolfSSL and can cause ECDSA certificate verification routines to accept digests smaller than required because hash/digest size and OID checks are missing. The flaw is classified as `CWE-295` and weakens certificate-based authentication by reducing the assurance that an ECDSA signature was validated against the proper digest constraints. The issue impacts ECDSA/ECC verification in wolfSSL configurations where **EdDSA** or **ML-DSA** is also enabled, and the risk is greater when the public CA key is known. Public references point to a wolfSSL GitHub pull request as well as MITRE and NVD tracking, while severity data published by Tenable includes CVSS v2, v3, and v4 scoring that describes a network-reachable issue with significant confidentiality and integrity impact in newer versions.
Jun 30, 2026
Two high-severity memory-corruption vulnerabilities were disclosed in widely used TLS-related software components. **CVE-2026-5264** affects wolfSSL and stems from DTLS 1.3 ACK message processing, where a remote attacker can send a crafted ACK packet to trigger a heap buffer overflow. The flaw is classified as `CWE-122` and is network-reachable with low attack complexity and no privileges or user interaction required, raising concern for applications that expose DTLS 1.3 services. A separate flaw, **CVE-2026-5402**, was disclosed in Wireshark’s TLS protocol dissector and affects versions `4.6.0` through `4.6.4`. The vulnerability is also a heap-based buffer overflow (`CWE-122`) and could allow denial of service and possible code execution when malicious traffic is processed, with the CVSS vector indicating high impact to confidentiality, integrity, and availability. Public references point to a wolfSSL GitHub pull request for the DTLS issue and to a GitLab issue and official Wireshark security advisory for the dissector flaw.
Jun 29, 2026
OpenSSL disclosed a broad set of vulnerabilities affecting ASN.1 parsing, PKCS#12, CMS/PKCS#7, QUIC, OCSP, CMP/CRMF, DH key validation, AEAD cipher handling, and certificate and email validation across the 4.0, 3.6, 3.5, 3.4, and 3.0 branches. The most severe issue, **CVE-2026-45447**, is a high-severity heap use-after-free in `PKCS7_verify()` that can be triggered by specially crafted PKCS#7 or S/MIME signed messages and could lead to crashes, heap corruption, or potentially remote code execution. The advisory also details moderate-severity flaws that could enable forged CMS `AuthEnvelopedData` messages, denial-of-service conditions in QUIC and OCSP processing, a TLS client double-free via OCSP stapling, a QUIC server `NULL` dereference, and cryptographic failures in AES-OCB when applications use the `EVP_Cipher()` one-shot API, alongside numerous lower-severity parsing, validation, and bounds-checking bugs. OpenSSL said most issues were fixed in **4.0.1**, **3.6.3**, **3.5.7**, **3.4.6**, and **3.0.21**, with **1.1.1zh** and **1.0.2zq** issued for supported legacy customers; most flaws were reported as outside the OpenSSL FIPS module boundary, except **CVE-2026-42770**, which affects FIPS modules in multiple supported branches.
Jun 29, 2026